jQuery-Upload-File XSS in fileNameStr

Description

A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 4.0.11

References

• GHSA-43x9-7hfv-mxrf
• CVE-2021-37504
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Unrestricted Upload of File with Dangerous Type in jquery-file-upload - CVE-2018-9207
• XSS in the `of` option of the `.position()` util in jquery-ui - CVE-2021-41184
• XSS in the `altField` option of the Datepicker widget in jquery-ui - CVE-2021-41182
• XSS in `*Text` options of the Datepicker widget in jquery-ui - CVE-2021-41183

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

npm

jquery-file-upload